{"record":{"id":"3e71e2d3bb00c1eb","repo":"netbirdio/netbird","slug":"at-least-one-artifact-pub-key-file-must-be-provi","errorCode":null,"errorMessage":"at least one --artifact-pub-key-file must be provided","messagePattern":"at least one --artifact-pub-key-file must be provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/cmd/signer/artifactkey.go","lineNumber":49,"sourceCode":"\t\tif createArtifactKeyExpiration <= 0 {\n\t\t\treturn fmt.Errorf(\"--expiration must be a positive duration (e.g., 720h, 365d, 8760h)\")\n\t\t}\n\n\t\tif err := handleCreateArtifactKey(cmd, createArtifactKeyRootPrivKeyFile, createArtifactKeyPrivKeyFile, createArtifactKeyPubKeyFile, createArtifactKeyExpiration); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to create artifact key: %w\", err)\n\t\t}\n\t\treturn nil\n\t},\n}\n\nvar bundlePubKeysCmd = &cobra.Command{\n\tUse:   \"bundle-pub-keys\",\n\tShort: \"Bundle multiple artifact public keys into a signed package\",\n\tLong: `Bundle one or more artifact public keys into a signed package using the root private key.\nThis command is typically used to distribute or authorize a set of valid artifact signing keys.`,\n\tRunE: func(cmd *cobra.Command, args []string) error {\n\t\tif len(bundlePubKeysPubKeyFiles) == 0 {\n\t\t\treturn fmt.Errorf(\"at least one --artifact-pub-key-file must be provided\")\n\t\t}\n\n\t\tif err := handleBundlePubKeys(cmd, bundlePubKeysRootPrivKeyFile, bundlePubKeysPubKeyFiles, bundlePubKeysFile); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to bundle public keys: %w\", err)\n\t\t}\n\t\treturn nil\n\t},\n}\n\nfunc init() {\n\trootCmd.AddCommand(createArtifactKeyCmd)\n\n\tcreateArtifactKeyCmd.Flags().StringVar(&createArtifactKeyRootPrivKeyFile, \"root-private-key-file\", \"\", \"Path to the root private key file used to sign the artifact key\")\n\tcreateArtifactKeyCmd.Flags().StringVar(&createArtifactKeyPrivKeyFile, \"artifact-priv-key-file\", \"\", \"Path where the artifact private key will be saved\")\n\tcreateArtifactKeyCmd.Flags().StringVar(&createArtifactKeyPubKeyFile, \"artifact-pub-key-file\", \"\", \"Path where the artifact public key will be saved\")\n\tcreateArtifactKeyCmd.Flags().DurationVar(&createArtifactKeyExpiration, \"expiration\", 0, \"Expiration duration for the artifact key (e.g., 720h, 365d, 8760h)\")\n\n\tif err := createArtifactKeyCmd.MarkFlagRequired(\"root-private-key-file\"); err != nil {","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/signer/artifactkey.go#L31-L67","documentation":"Returned by the signer CLI's bundle-pub-keys cobra command when it is invoked without any --artifact-pub-key-file flags. The command bundles one or more artifact public keys into a package signed by the root private key, so an empty key list is a pure usage error and nothing is executed. It is thrown before any file is read or key is parsed.","triggerScenarios":"Running 'netbird-signer bundle-pub-keys' (or the signer binary's equivalent) with only --root-private-key-file and --bundle-pub-key-file set, omitting every --artifact-pub-key-file occurrence. The flag is a slice, so it is only populated when provided at least once.","commonSituations":"Scripts that template the flag list and expand to an empty string; CI pipelines where the key list variable is empty; copy-pasting an example command that only shows the required output flags.","solutions":["Pass at least one --artifact-pub-key-file <path> (the flag repeats: --artifact-pub-key-file a.pub --artifact-pub-key-file b.pub)","Verify the shell variable holding the key list is non-empty before invoking the command","Check 'bundle-pub-keys --help' to confirm flag spelling and repeatability"],"exampleFix":"// before\nsigner bundle-pub-keys --root-private-key-file root.pem --bundle-pub-key-file bundle.pem\n// after\nsigner bundle-pub-keys --root-private-key-file root.pem --artifact-pub-key-file artifact.pub --bundle-pub-key-file bundle.pem","handlingStrategy":"validation","validationCode":"# before calling the CLI\n[ ${#PUB_KEY_FILES[@]} -ge 1 ] || { echo \"need at least one --artifact-pub-key-file\"; exit 1; }\nsigner bundle-pub-keys --root-private-key-file root.pem \"${PUB_KEY_FILES[@]/#/--artifact-pub-key-file }\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fail fast in the invoking script when the key list variable is empty","Quote and count the expanded list before building flags","Keep a --dry-run style argument echo in CI logs so the exact flag set is visible"],"tags":["cli","signing","validation","go","cobra"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}